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(57) Abstract: 



PURPOSE: A method for 
automatically monitoring invasion 
and cutting off hacking in real time, 
is provided to pass hardware and 
software simultaneously performing 
the functions of invasion cutoff and 
monitoring for every packet 
information accessing to an internal 
network through an external 
information and communication 
network, so as to completely cut off 
related packet and messages. 

CONSTITUTION: A data packet 
accessed through an external 
information and communication 
network like the Internet is read 
from a packet collector. If the data 
packet is for completion, the steps 
are ended. If the data packet is not 
completed, packet filtering is 
processed for packet information 
which is a result of the packet 
reading, by referring to an invasion 
cutoff rule in an invasion cutoff rule 
storage. If the data are for invasion, 
the packet is perished. If the data 
are not for invasion, a log 
processor performs packet filtering 
log processing. Invasion monitoring 
engine decides invasion by referring 
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to an invasion pattern within 
invasion pattern database storage. Log processing of a result of invasion decision is performed to 
the log processor. If a decided result is not for invasion, packet transmission is performed. If the 
decided result is for invasion, the invasion monitoring engine performs an invasion cutoff rule 
automatically adding packet information to an invasion cutoff rule storage. Alarm and notification 
are performed to an alarm and notification processor. The packet is perished and the first step is 
returned. 
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